CVE-2024-48061

CVE-2024-48061 Langflow vulnerable to remote code execution CVE-2024-48061 poc Usage python3 poc.py -i -p -l -lp Description This script exploits a vulnerable API endpoint at /api/v1/validate/code on the target web server. It first verifies the presence of the vulnerable path, then starts a TCP...

CVE-2025-59843-CVE-2025-59932

CVE-2025-59843 & CVE-2025-59932 1. Public Exposure of User Email Addresses CVE-2025-59843 In Scope / Affected Application: FlagForge Web Application API Endpoint: /api/user/username Details: The endpoint returns user email addresses without authentication. Any username can be queried publicly...

CVE-2026-6723

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 1.6.11.11. This is due to the appointment update REST API endpoint not restricting which fields can be modified by...

API-Wordlist

apiwordlist A wordlist of API names used for fuzzing web application APIs. Contents apiseeninwild.txt - This contains API function names I've seen in the wild. actions.txt - All API function name verbs objects.txt - All API function name nouns actions-uppercase.txt - API function name verbs with...

CVE-2026-25513

CVE-2026-25513: FacturaScripts has SQL Injection in API ORDER BY Clause Overview Field| Details ---|--- CVE ID| CVE-2026-25513 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products facturascripts/facturascripts versions: 2025.81 CWE Classification CWE-20: Improper...

CVE-2025-3248

Technical Analysis & Defensive Guide: CVE-2025-3248 Langflow Code Injection An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow. 📌 Vulnerability Profile CVE ID: CVE-2025-3248 Vulnerability Type: Remote Code Execution RCE /...

CVE-2026-27944

CVE-2026-27944 A proof of concept script for CVE-2026-27944, a critical exploit allowing nginx-ui backups to be decrypted DISCLAIMER This Proof of Concept is for educational and ethical security testing purposes only. It was developed to demonstrate the technical root cause of CVE-2026-27944 as...

CVE-2023-27163

CVE-2023-27163 This is a PoC for CVE-2023-27163 which is a SSRF vulnerability present in request-baskets upto v1.2.1. This vulnerability allows attackers to access sensitive network resources via /api/baskets/name. The request-baskets contains a functionality where a user can specify another serv...

zenml-CVE-2024-2083-POC

CVE-2024-2083 – ZenML Arbitrary File Read PoC This repository demonstrates how to reproduce CVE-2024-2083 , an Arbitrary File Read vulnerability in ZenML. The issue allows an attacker to read files from the server filesystem by abusing the logs.uri field in the /api/v1/steps API request. By...

CVE-2026-7020

CVE-2026-7020 Ollama arbitrary file read via tensor digest path traversal. Exfiltrates SSH host keys and any other file from a reachable Ollama host in three unauthenticated API calls. Writeup: Co-Researcher @gouldnicholas Usage python3 poc.py Tries all three SSH host key types with known sizes a...

CVE-2026-23520

CVE-2026-23520 MCP API Remote Command Execution RCE PoC 📌 Overview This repository contains a Proof-of-Concept PoC exploit for a Remote Command Execution RCE vulnerability affecting applications that expose a vulnerable MCP API endpoint commonly /api/mcp/connect. The vulnerability allows executio...

zimaos-cve-2026-28286-arbitrary-file-write

🚨 CVE-2026-28286 — ZimaOS Arbitrary File Write From API Misconfiguration → Arbitrary File Write → Potential System Compromise ⚡ TL;DR Endpoint: /v21/files/file Issue: No path validation Impact: Arbitrary file write outside the intended directory Severity: 🔴 Critical 🧪 Quick Start git clone...

CVE-2026-23744-PoC

CVE-2026-23744-PoC MCP RCE Exploit Linux PoC to exploit /api/mcp/connect for remote command execution. Requirements pip install requests Usage python3 exploit.py Example: python3 exploit.py mcp.something.com Configuration edit in script attackerip = "YOURIP" port = 4444 Listener nc -lvnp 4444...

CVE-2026-35045-PoC

CVE-2026-35045 — Broken Object-Level Authorization in Tandoor Recipes Summary The PUT /api/recipe/batchupdate/ endpoint in Tandoor Recipes v2.6.1 allows any authenticated user within a Space to modify any recipe in that Space — including private recipes owned by other users. This completely...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85423

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-85423

A vulnerability exists in the data collection service of Brocade ASCG versions prior to 3.5.0 . An API endpoint within the data collector service lacks proper authentication or authorization checks for incoming requests. An attacker with network access can exploit this to instruct the application...

PT-2026-107854

A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the...

CVE-2026-76271

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...